After the 23andMe Settlement: What to Check in Your DNA Account
My own 23andMe saliva collection kit, May 2021.
On October 19, California Attorney General Rob Bonta announced a $6 million settlement with Chrome Holding Co., the company formerly known as 23andMe. It was filed in the U.S. Bankruptcy Court for the Eastern District of Missouri and is still pending court approval. The case grew out of the 2023 data breach, which the Attorney General’s office says “impacted nearly 7 million 23andMe customers across the United States.”
My family was among the people who had to think about what that meant.
Why I Tested
In 2021 I sent saliva samples to 23andMe and AncestryDNA. I was looking for my birth father, a search I had been working on my own for more than eight years. The first results, from 23andMe, came back with more than 1,500 predicted DNA matches. The Ancestry results arrived about two weeks later. With the records and a genetic genealogy research team’s help, they led me to him. I tell that story in full in The Search for My Father.
Before then, my testing had been private: a court-ordered paternity test, and later a DNA test with a suspected uncle. As I told the News Journal in Wilmington, Ohio, in September 2021, testing with “alleged relatives who were known to me” gave me “some control and limited my risk.” A commercial test was different. It was, I said then, “like throwing my DNA sample into a gene pool of more than 26 million people.”
That is the trade every DNA test makes. You give up a bit of your privacy for genetic information that may answer an unresolved family question or tell you something important about your health. When the breach was in the news, my daughter also had a 23andMe account, and we talked about what it could mean for our information. It was unsettling to have trusted a company with our DNA and then watch it become the victim of an attack. I changed my 23andMe privacy settings as a precaution. Today I work mainly in my AncestryDNA account, with its ThruLines matches.
My own AncestryDNA kit, May 2021.
Five Checks for Any DNA Account
The settlement is about one company. The checks below apply to any of them. Menu names change, so follow the labels on your own screen.
1. Download your raw data first. Your raw DNA file is a plain text file of your results. Keep a copy before you change anything else, and keep it in more than one place. I saved my raw data from both companies in 2021, and I downloaded my 23andMe match list again in October 2023, after the breach was made public. On AncestryDNA it starts in your DNA settings, under the section for downloading or deleting your data, and the download link comes by email. Treat the file like any other private record: once it is on your computer, its security is up to you.
2. Read your matching settings. Relative matching is the feature that found my father. It also shows you to strangers, and shows them to you. Decide on purpose whether you want to be visible to matches.
3. Read your research consent. Most companies ask whether your data may be used in research. At 23andMe, the Attorney General’s release says that consent is withdrawn under “Research and Product Consents” in your account settings.
4. Know where your sample is. Some companies store the saliva sample itself. At 23andMe, according to the same release, you change that storage preference under “Preferences” in your account settings.
5. Know how deletion works, and do it last. Deleting your data cannot be undone, which is why the download comes first. At 23andMe, the release gives the path: Settings, then “View” next to “23andMe Data,” then “Permanently Delete Data,” confirmed through an email the company sends. California says affected customers keep the right to request deletion of their information and destruction of their samples.
One more, if you have uploaded your DNA to GEDmatch. Each kit there carries a privacy level, and one level allows your kit to be compared with kits submitted by law enforcement. I chose that option for my own kit, knowing what it means. Whatever you choose, make it a choice and not a default.
Your DNA Is Also Your Family’s
DNA is the one record you share with every relative, including the ones who never tested. That is why it can find a missing father, and why a breach at one company reaches far beyond the people who sent in a sample. I would test again. I would also read the settings first.
For what the settlement means for you, read the Attorney General’s release itself. For what DNA can and can’t settle once you have it, see A Strand of Hair, Sixty-Two Cousins. And if a match has handed you a question your records can’t answer, I would like to hear from you.
Sources: Office of the Attorney General, State of California, “Attorney General Bonta Secures $6 Million Settlement in 23andMe Litigation,” October 19, 2026. News Journal (Wilmington, Ohio), September 24, 2021. Ancestry Support, “Downloading DNA Data.” GEDmatch, “Privacy and Security,” gedmatch.com, read October 27, 2026.
